Threat modeling (STRIDE, DREAD) in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the STRIDE category for spoofing attacks.

Cybersecurity

threat_category = "[1]"  # STRIDE category for pretending to be someone else

Drag options to blanks, or click blank then click option'

ARepudiation

BTampering

CElevation of Privilege

DSpoofing

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing spoofing with tampering or repudiation.

Choosing elevation of privilege instead of spoofing.

Spoofing means pretending to be someone else to gain unauthorized access. It is one of the STRIDE threat categories.

2fill in blank

medium

Complete the code to calculate the DREAD risk score by summing the components.

Cybersecurity

risk_score = damage_potential + reproducibility + exploitability + affected_users + discoverability
average_risk = risk_score / [1]  # Number of DREAD factors

Drag options to blanks, or click blank then click option'

A4

B5

C3

D6

Attempts:

3 left

💡 Hint

Common Mistakes

Using 4 or 6 instead of 5 as the divisor.

Forgetting to divide by the number of factors.

DREAD has 5 factors: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. The average risk divides the total by 5.

3fill in blank

hard

Fix the error in the STRIDE threat identification code.

Cybersecurity

if threat == "[1]":
    print("This threat involves unauthorized data changes.")

Drag options to blanks, or click blank then click option'

ATampering

BDenial of Service

CRepudiation

DSpoofing

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing spoofing or repudiation which do not mean data changes.

Using Denial of Service which is about availability.

Tampering refers to unauthorized modification of data or code. The code checks for tampering to print the correct message.

4fill in blank

hard

Fill both blanks to complete the DREAD risk calculation for a threat with given scores.

Cybersecurity

total_score = [1] + [2] + exploitability + affected_users + discoverability
average_score = total_score / 5

Drag options to blanks, or click blank then click option'

Adamage_potential

Breproducibility

Cspoofing

Dtampering

Attempts:

3 left

💡 Hint

Common Mistakes

Using STRIDE categories instead of DREAD factors.

Mixing threat types with risk factors.

The DREAD risk score sums damage potential and reproducibility along with other factors. Spoofing and tampering are STRIDE categories, not DREAD factors.

5fill in blank

hard

Fill all three blanks to create a dictionary mapping STRIDE categories to their descriptions.

Cybersecurity

stride_dict = {
    "S": "[1]",
    "T": "[2]",
    "R": "[3]"
}

Drag options to blanks, or click blank then click option'

ASpoofing - pretending to be someone else

BTampering - unauthorized data modification

CRepudiation - denying actions taken

DDenial of Service - making services unavailable

Attempts:

3 left

💡 Hint

Common Mistakes

Using Denial of Service for S, T, or R keys.

Mixing descriptions between categories.

STRIDE categories S, T, and R stand for Spoofing, Tampering, and Repudiation respectively, with their common descriptions.

Practice

1. What is the main purpose of threat modeling in cybersecurity?

easy

A. To identify and prioritize potential security risks before they happen

B. To write code faster

C. To design user interfaces

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand the goal of threat modeling

   Threat modeling is used to find security risks early in a system or application.

2. Step 2: Identify the main benefit

   It helps prioritize which risks to fix first to prevent harm.

3. Final Answer:

   To identify and prioritize potential security risks before they happen -> Option A

4. Quick Check:

   Threat modeling = find and rank risks [OK]

Hint: Threat modeling = find risks early and rank them [OK]

Common Mistakes:

• Confusing threat modeling with coding or UI design
• Thinking it monitors live traffic
• Assuming it fixes risks automatically

2. Which of the following correctly lists categories from the STRIDE threat model?

easy

A. Security, Trust, Reliability, Integrity, Data, Encryption

B. Scanning, Testing, Reporting, Investigating, Defending, Encrypting

C. Spoofing, Testing, Reporting, Information, Denial, Elevation

D. Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Solution

1. Step 1: Recall STRIDE categories

   STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

2. Step 2: Match options to STRIDE

   Only Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege lists all correct STRIDE categories in full.

3. Final Answer:

   Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege -> Option D

4. Quick Check:

   STRIDE = STRIDE categories [OK]

Hint: STRIDE is an acronym for six threat types [OK]

Common Mistakes:

• Mixing unrelated security terms
• Partial or incorrect category names
• Assuming STRIDE includes testing or encryption

3. Given a threat scored in DREAD as follows: Damage potential=3, Reproducibility=2, Exploitability=4, Affected users=3, Discoverability=1. What is the total DREAD score?

medium

A. 13

B. 12

C. 10

D. 9

Solution

1. Step 1: Add all DREAD components

   Sum the scores: 3 + 2 + 4 + 3 + 1 = 13.

2. Step 2: Verify calculation

   Check each value carefully to avoid mistakes.

3. Final Answer:

   13 -> Option A

4. Quick Check:

   Sum of DREAD scores = 13 [OK]

Hint: Add all five DREAD scores to get total [OK]

Common Mistakes:

• Forgetting one category in sum
• Adding incorrectly
• Confusing DREAD with STRIDE categories

4. A security analyst uses STRIDE but mistakenly includes 'Encryption' as a category. What is the error in this approach?

medium

A. Encryption is part of STRIDE under Denial of Service

B. Encryption is not a STRIDE threat category; it is a security control

C. Encryption is a DREAD scoring factor

D. Encryption is a type of Repudiation threat

Solution

1. Step 1: Understand STRIDE categories

   STRIDE categories are specific threat types, not security controls.

2. Step 2: Identify role of encryption

   Encryption is a defense method, not a threat category.

3. Final Answer:

   Encryption is not a STRIDE threat category; it is a security control -> Option B

4. Quick Check:

   Encryption = control, not STRIDE threat [OK]

Hint: STRIDE lists threats, not defenses like encryption [OK]

Common Mistakes:

• Confusing security controls with threat categories
• Mixing STRIDE and DREAD concepts
• Assuming encryption causes threats

5. You have two threats: Threat A with DREAD scores (Damage=5, Reproducibility=3, Exploitability=4, Affected Users=2, Discoverability=3) and Threat B with scores (Damage=4, Reproducibility=4, Exploitability=3, Affected Users=5, Discoverability=2). Which threat should be fixed first based on DREAD, and why?

hard

A. Threat B, because it has higher reproducibility

B. Threat A, because its total DREAD score is higher indicating greater risk

C. Threat B, because it has the higher total DREAD score indicating greater risk

D. Threat A, because it has higher damage potential only

Solution

1. Step 1: Calculate total DREAD scores for both threats

   Threat A: 5+3+4+2+3=17; Threat B: 4+4+3+5+2=18.

2. Step 2: Compare total scores and interpret

   Threat B has a higher total score (18) than Threat A (17), so Threat B is higher risk.

3. Step 3: Re-examine options carefully

   Threat A, because its total DREAD score is higher indicating greater risk incorrectly states Threat A has higher score. Options C and D focus on single factors instead of total score.

4. Final Answer:

   Threat B, because it has the higher total DREAD score indicating greater risk -> Option C

5. Quick Check:

   Total DREAD score guides priority [OK]

Hint: Sum DREAD scores; higher total means higher priority [OK]

Common Mistakes:

• Choosing based on one factor only
• Misadding scores
• Ignoring total DREAD score